Australia’s new mandatory data breach disclosure law is attracting a lot of attention, and a lot of criticism. But it will also have some interesting – and perhaps unintended – consequences.
Most commentary has been about the fact that it will give Australia some of the strictest disclosure rules in the world. That is a good thing to some people and a bad thing to others.
Some critics, such as the recently formed group Data Governance Australia, are still trying to stop the law.
The chief executive of Data Governance Australia, Graeme Samuels, former head of the ACCC, says the legislation is “heavy-handed” and wants instead an industry voluntary code of conduct.
It is almost certainly too late for that.
After a long and tortuous path through Parliament that began five years and three governments ago, the bill has now been introduced to Parliament. It will almost certainly pass, because it has support from both sides of politics.
The legislation places a strong responsibility on public and private sector organisations to ensure they are aware of data breaches, and that they act on them promptly.
It sets the bar lower than many such laws in other jurisdictions. It will mean it is not enough that an organisation makes a disclosure after it discovers a breach. Reading the legislation literally, the disclosure must be made even if the organisation simply believes a breach has occurred.
The bill will have the effect of significantly raising the profile of data security in most organisations. That is a good thing – in the modern world nearly all our information assets are in electronic form, and those assets have significant value.
Unexpected consequences
But the legislation also has the potential to significantly affect planning for a national electronic ID plan, and for any attempts to harmonise state and federal moves in that direction.
The Australian Government’s Digital Transformation Agency – formerly the Digital Transformation Office – has indicated that it wants to introduce a voluntary electronic ID system, perhaps using voice identification technology already adopted by the Australian Taxation Office and Centrelink.
It would be used with the MyGov system, which enables a single sign-on by citizens wishing to deal online with multiple government departments.
But the NSW Government has developed a separate system for Service NSW, which does the same thing for people dealing with separate agencies in that state.
Other states are also considering electronic ID systems. There has been some talk of unifying them all through MyGov, but this is unlikely to happen without uniform privacy and data breach notification in each state.
The new data breach notification legislation covers Australian Government agencies and private organisations with an annual turnover of more than $3 million.
But it does not cover state government agencies, all of which operate under their state’s own privacy laws, none of which include mandatory data breach disclosure.
The fact the states and territories are specifically excluded from the federal legislation makes co-operation on an electronic ID standard problematic.
Section 109 of the Constitution says federal law overrides state law, but the states may not wish to subject themselves to the more onerous reporting requirements of the federal data breach reporting legislation, which could act as a disincentive to any co-operation in this area.
Opportunity for harmony
This is a problem, but it is also an opportunity. It is an opportunity for the states to update and harmonise their privacy laws so that there is a uniform regime operating across the country.
That will ensure all government agencies – federal, state and local – will be able to take advantage of the requirements of the new law to improve the integrity of their systems, and to take advantage of a unified national electronic ID system.
That would have many advantages. A single sign-on for citizens dealing with governments at all levels would greatly facilitate the growth of e-government in Australia, and would mean all government agencies would need to be much more serious around security, and in particular around their ability to monitor, detect, respond and report on data breaches.
Originally, the new mandatory data breach disclosure legislation said that a notification must be made “if an entity is aware, or ought reasonably to be aware, that there are reasonable grounds to believe that there has been a serious data breach of the entity, the entity must, as soon as practicable after the entity becomes so aware, or ought reasonably to have become so aware, as the case may be”.
It stated that an organisation cannot claim it did not know a breach had occurred. It cannot be wilfully blind to breaches, and it cannot claim plausible deniability around security incidents.
It also means that breaches need to be properly investigated, and in a timely manner – you have a 30-day limit to conduct your investigation.
Reports since the draft bill was developed have stated that the government is considering changing the language to remove the requirement for notification if an organisation “ought to have been aware”, however, we are yet to see these changes take place.
Important change
Data breaches are not good for public trust and they are not good for people whose personal details are compromised. The bill marks an important change, because it says essentially that if a data breach occurs there are no mitigating circumstances.
Organisations will need to properly determine the amount of harm the breach causes.
It is clear that the intent behind the terminology in the legislation is to make it an imperative for organisations, in the private and public sectors, to step up their cyber security capabilities.
Over the last few years we have seen a large number of highly publicised data breaches, with substantial evidence that many organisations did not have effective process or procedures, or the right people, to prevent the breaches, remediate them, or to properly inform affected parties.
The new legislation is intended to ensure there is much less chance of that happening in Australia in the future.
All organisations will have to take cyber security more seriously, and be more proactive in improving their monitoring, detection and reporting.
By: Leonard Kleinman – Leonard Klienman is chief cyber security adviser, Asia Pacific and Japan, for security company RSA.
Brisbane Hosting & Website Hosting’s products and services include Website Hosting, Domain Names, DNS Services, Website Development, Website Design, Website Revamps, Website Maintenance, Social Media Campaigns and more.
Contact Brisbane Hosting on (07) 3889 2977 or via email info@brisbanehosting.com.au for further information and quote today.
